Why Ghaziabad Students Are Choosing Ethical Hacking in 2026

# A basic recon example — what ethical hacking actually looks like
# Run only against systems you own or are explicitly authorised to test.

# 1. Basic port scan of an authorised target (using nmap)
nmap -sV -sC -p- target.example.com

# 2. Enumerate directories on a web app
gobuster dir -u https://target.example.com \
             -w /usr/share/wordlists/dirb/common.txt

# 3. Check subdomain exposure
subfinder -d target.example.com -silent | httpx -silent

# 4. Look at HTTP headers for misconfigurations
curl -I https://target.example.com

# 5. Review JavaScript files for leaked endpoints/keys
#    (use any JS beautifier, then read carefully)

# The job isn't "find one exploit".
# It's: map the surface, look for patterns, document what you find,
# and write clear guidance on how the team should fix it.

# A real bug report — from a student's bug bounty submission

Title
  Reflected XSS in the search parameter on /products

Severity
  High — user-controlled input is reflected without encoding,
  allowing session theft if an authenticated user clicks a
  crafted link.

Reproduction steps
  1. Go to https://target.example.com/products?q=test
  2. Replace "test" with the payload below
  3. Observe the script executes in the page context

Payload
  <script>alert(document.cookie)</script>

Affected parameter
  q

Environment
  Chrome 126, logged-in user session

Expected behaviour
  The search term is HTML-encoded before being rendered

Actual behaviour
  The search term is inserted into the DOM as raw HTML,
  allowing script execution

Suggested fix
  HTML-encode the parameter on the server, or set a strict
  Content-Security-Policy that blocks inline scripts

Impact
  An attacker can craft a URL that steals a victim's session
  cookie, leading to account takeover

What students actually submit to bug bounty programmes
  → These reports. Clear, reproducible, responsible.
  → Not exploits with no explanation.
  → Not screenshots with no context.

Weekly routine — for a student in Ghaziabad

Mon–Fri (2 hours/day)
  - 60 min: learning (Networking, Linux, OWASP, Python)
  - 30 min: hands-on (Kali VM, DVWA, Juice Shop)
  - 30 min: notes + write up what you found

Saturday (4 hours)
  - Full lab session — try one machine on TryHackMe or HTB
  - Write the walkthrough (screenshots + steps + fix guidance)
  - Publish on a personal blog or GitHub

Sunday (2 hours)
  - Review the week
  - Read one public bug bounty write-up
  - Plan the next week

Total: ~15–16 hours per week
Rule: quality of notes > number of machines solved.

Certification path — for students starting in 2026

Entry / foundational
  → CompTIA Security+
    - Broad security foundation
    - Recognised across industries
    - Good first certification

Offensive / practical
  → eJPT (INE Security)
    - Hands-on, practical exam
    - Affordable and beginner-friendly
    - Strong signal to employers

  → CEH (EC-Council)
    - Widely recognised in India
    - Theory-heavy
    - Often expected in job postings

  → OSCP (Offensive Security)
    - Industry gold standard for offensive roles
    - Very practical, 24-hour exam
    - Best attempted after 6–12 months of practice

Suggested order for a student
  1. CompTIA Security+ or eJPT (first, easiest to pass)
  2. Then CEH or OSCP depending on the role
  3. Never collect three certs without a single project

Reality check
  Certs help you get past the filter.
  Write-ups and lab hours get you the offer.

Ethical hacking portfolio — for Ghaziabad students

Write-up 1 · Web app lab
  ☐ Target: DVWA or Juice Shop
  ☐ Finding: SQL injection or XSS
  ☐ Steps to reproduce, with screenshots
  ☐ Impact explanation in plain English
  ☐ Suggested fix
  ☐ Published on GitHub or a blog

Write-up 2 · TryHackMe / HTB machine
  ☐ Recon steps
  ☐ Exploitation path
  ☐ Privilege escalation
  ☐ Lesson learned
  ☐ Screenshots and commands

Write-up 3 · Bug bounty / VDP report (even if it's informational)
  ☐ Finding summary
  ☐ Reproduction steps
  ☐ Responsible disclosure timeline

Across the portfolio
  ☐ All targets are authorised — no real company without permission
  ☐ No client data or PII in screenshots
  ☐ Clear structure — read like a professional
  ☐ Pinned on GitHub with a README index

What gets you interviews
  → Clear write-ups
  → Communication
  → Proof you can follow a methodology

Typical entry-level security interview flow

Round 1 · Screening (30 min)
  - Background, motivation, basics
  - Sometimes a short networking or OWASP quiz

Round 2 · Technical (45–60 min)
  - How HTTP works, what a session is
  - Explain how SQL injection / XSS work
  - Walk through a finding from your portfolio
  - Basic Linux command-line questions

Round 3 · Practical (varies)
  - Sometimes a CTF-style challenge or lab
  - Sometimes a written report on a provided test environment
  - Scored on methodology, not just "got a flag"

Round 4 · Behavioural (30–45 min)
  - Communication, curiosity, ethics
  - "Tell me about a bug you found"
  - "How would you report a critical issue to a non-technical manager?"

Round 5 · HR / offer

What interviewers score
  ✓ Structured methodology
  ✓ Clear communication
  ✓ Responsible handling (no damage, no leaks)
  ✓ Willingness to learn
  ✗ Not how many machines you solved
  ✗ Not how fast you hacked something